fix(ci): pin scanner versions and disable install lifecycle scripts

SonarCloud's gate on main has been red since 2026-08-21 on
new_security_rating (C, threshold A) from four MAJOR supply-chain
findings that its new-code window sweeps in:

- release.yml and scripts/release.sh ran `npm ci` with dependency
  lifecycle scripts enabled during a release build (S6505)
- security.yml installed pip and semgrep unpinned (S8544)
- security.yml resolved jscpd on demand through `npx --yes` (S6505)

Add --ignore-scripts to both release installs, pin pip/semgrep to
exact versions, and install jscpd at an exact version with lifecycle
scripts disabled before invoking it with --no-install.

Verified locally: the vite build produces identical output under
npm ci --ignore-scripts, and the rewritten jscpd invocation reports
the same 3 pre-existing clones and exits 0.

Author: aksOps

.github/workflows/release.yml

@@ -80,7 +80,9 @@ jobs:
         # goreleaser compiles. `npm run build` emits into internal/ui/dist.
         run: |
           cd ui
-          npm ci
+          # --ignore-scripts: no dependency lifecycle script runs during a
+          # release install. Verified the vite build needs none.
+          npm ci --ignore-scripts
           npm run build
           test -f ../internal/ui/dist/index.html
           # vite's emptyOutDir wipes internal/ui/dist on rebuild, deleting the

.github/workflows/security.yml

@@ -90,7 +90,9 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install semgrep
-        run: python -m pip install --quiet --upgrade pip semgrep
+        # Pinned: a scanner that silently changes version changes the
+        # merge gate under everyone without a commit saying so.
+        run: python -m pip install --quiet "pip==26.2.1" "semgrep==1.174.0"
       - name: Run semgrep (security-audit + owasp-top-ten + golang)
         run: |
           semgrep scan \
@@ -151,7 +153,10 @@ jobs:
           # function body is ~40-80 tokens; 100 corresponds to a real
           # method body or a non-trivial code block, not import/struct
           # boilerplate that 200+ Go files share by convention.
-          npx --yes jscpd@4 \
+          # Installed with lifecycle scripts disabled and an exact version
+          # rather than resolved on demand by npx.
+          npm install --no-save --ignore-scripts jscpd@4.3.0
+          npx --no-install jscpd \
             --threshold 3 \
             --min-tokens 100 \
             --reporters consoleFull \

scripts/release.sh

@@ -62,8 +62,10 @@ cleanup() { git reset --hard --quiet "$base"; git clean -fdq -- internal/ui/dist
 trap cleanup EXIT
 
 # --- Build the UI ------------------------------------------------------------
-echo "▸ building UI (npm ci && npm run build)…"
-( cd ui && npm ci && npm run build )
+echo "▸ building UI (npm ci --ignore-scripts && npm run build)…"
+# --ignore-scripts: no dependency lifecycle script runs during a release
+# install. Verified the vite build needs none.
+( cd ui && npm ci --ignore-scripts && npm run build )
 [ -f internal/ui/dist/index.html ] || { echo "error: UI build produced no dist/index.html" >&2; exit 1; }
 touch internal/ui/dist/.gitkeep   # vite emptyOutDir wipes it; keep the placeholder